Privacy.

This policy explains how UpLevel Technologies LLC ("ZyloPay", "we") handles personal data when you use the ZyloPay mobile app (iOS and Android), the ZyloPay web apps (pay.zylopay.com, merchant.zylopay.com), the ZyloPay World App mini app and the ZyloPay payment network. ZyloPay is for people aged 18 and over. We do not knowingly collect data from anyone under 18; if you believe a minor has created an account, contact privacy@zylopay.com and we will delete it.

— Account: your email address, and the name you add to your profile (optional). If you sign in with Apple or Google, we receive the email address that provider shares (Apple may give a private relay address). — Wallet: the address of your ZyloPay wallet, which is created for you at sign-in. — Payments and passes: payments you make (merchant, amount, fees, cashback, time, status), refunds, payment approvals you confirm or decline, your spending limit and its expiry, the Apple Wallet or Google Wallet passes you create, AI agent keys you create (their name, limits and use) and rewards. — Balances: your USDC balance and on-chain activity of your wallet, read from the public blockchain. — Device: the push notification token of each phone where you turn on approval alerts, the platform and app version; for Apple Wallet passes, the identifiers Apple Wallet sends to keep your pass up to date. — Security: sign-in events (time, IP address, browser or app), and signals we use to prevent fraud and abuse. — Diagnostics: crash reports and performance data from the mobile app. They contain no account data: addresses, emails, tokens and keys are removed before they leave your device. — World App (only if you link it): your World App account address and, if you verify, a World ID verification proof (not your biometric data). We do not collect: biometric data (Face ID, Touch ID and fingerprint checks happen on your device, which only tells the app yes or no), camera images (QR codes are read on your device), your contacts, your location, or government ID in the current version of ZyloPay.

— To provide ZyloPay: create and secure your account and wallet, issue and update your wallet passes, process your payments and refunds, show your history, balances and rewards, and send the alerts you turn on (for example, a payment waiting for your approval). — To keep ZyloPay safe: detect and prevent fraud and abuse, protect your account, and screen wallet addresses against sanctions lists, as the law requires. — To fix and improve the app: crash reports and performance data. — To meet legal obligations and respond to lawful requests. We do not use your data for advertising, sell it, or build marketing profiles.

We share data only with providers that help us run ZyloPay, under contracts that require them to protect it and use it only for us: — Dynamic Labs: sign-in (email codes, Apple and Google sign-in) and your embedded wallet's key management. — Fly.io and Vercel: hosting for our servers and websites. — Apple and Google: push notifications and Apple Wallet / Google Wallet passes. — Sentry: crash reports and performance data from the mobile app. — Email delivery: receipts and account emails. — Blockchain infrastructure: Monad network nodes and RPC providers that broadcast and confirm transactions. With your action: when you buy USDC with Coinbase, Coinbase receives your wallet address and handles that purchase under its own privacy policy; when you link World App, World receives what is needed to link your accounts. We may disclose information when the law requires it (for example, a court order) or to protect the rights and safety of our users and ZyloPay. If ZyloPay is involved in a merger or acquisition, your data may be transferred under this policy.

ZyloPay settles payments on the Monad blockchain, a public ledger. Your wallet address, the merchant's identifier, the amount and the time of each settled payment are recorded on it permanently and can be seen by anyone. Nobody, including ZyloPay, can change or delete on-chain records.

We keep your data while your account is open. You can delete your account at any time in the app (Settings → Delete account) or by following the steps at zylopay.com/delete-account. When you delete your account, your passes and agent keys stop working at once and you are signed out everywhere. Within 30 days we delete your profile (name and email), notifications and device registrations. We keep records the law requires us to keep, such as payment, refund and sanctions-screening records, for as long as the law requires, and then delete them. Records on the blockchain cannot be deleted. Your wallet and any funds in it remain yours: move any funds you want to keep before you delete your account.

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict some processing, and to withdraw consent (for example, turn off alerts in Settings). To exercise a right, email privacy@zylopay.com from the email address on your account. We respond within 30 days. You can also complain to your local data protection authority.

Data is encrypted in transit. On your phone, sign-in tokens are kept in the device's secure storage (Keychain or Keystore) and never in plain storage. You can protect the app with Face ID, fingerprint or your device passcode, and payments above your limits need your approval. No system is perfectly secure; tell us about any vulnerability at security@zylopay.com.

We will post any change to this policy here and update the effective date; for significant changes we will also tell you in the app or by email. — Email: privacy@zylopay.com — Entity: UpLevel Technologies LLC — Address: Wilmington, Delaware, United States For security vulnerabilities, contact security@zylopay.com.